In response to the growing threat of identity theft, the United States Congress passed the Fair and Accurate Credit Transactions Act of 2003 (FACTA). Public Law 108-159. This amendment to the Fair Credit Reporting Act charged the Federal Trade Commission with promulgating rules regarding identity theft. On November 7, 2007, the Federal Trade Commission promulgated the final rules, known as “Red Flag” rules, which had an effective date of November 1, 2008. 16 CFR 681. These rules, implemented sections 114 and 315 of FACTA, requiring` certain municipal departments to enact certain policies and procedures by the November 1, 2008, effective date. The FACT Act contains seven major titles: Identity Theft Prevention and Credit History Restoration, Improvements in Use of and Consumer Access to Credit Information, Enhancing the Accuracy of Consumer Report Information, Limiting the Use and Sharing of Medical Information in the Financial System, Financial Literacy and Education Improvement, Protecting Employee Misconduct Investigations, and Relation to State Laws. The focus of this section is on the Identity Theft Prevention and Credit History Restoration provisions.

Definitions and Scope
The rules apply to “financial institutions” and “creditors” with “covered accounts.” Financial institution is defined as a state or national bank, a state or federal savings and loan association, a mutual savings bank, a state or federal credit union, or any other person that, directly or indirectly, holds a transaction account belonging to a consumer. Creditor means “any person who regularly extends, renews, or continuation of credit; or any assignee or an original creditor who participates in the decision to extend, renew, or continue credit" and includes lenders such as banks, finance companies, automobile dealers, mortgage brokers, utility companies, and telecommunications companies. A covered account is an “account that a financial institution or creditor offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, such as a credit card account, mortgage loan, automobile loan, margin account, cell phone account, utility account, checking account, or savings account.” A “red flag” is a pattern, practice or specific activity that indicates the possible existence of identity theft.

All municipal water, wastewater, natural gas, and electric utilities are explicitly covered under these rules. The Federal Trade Commission has suggested that municipal departments that “defer payments” for goods or services are also covered.